1

What I would consider to be hacking one of these services is something along the lines of cracking databases (or I think what would be databases). In reality, I have no idea how sites like these store passwords. From what I read a little bit ago, sites such as these with massive databases don't story every thing in one place, which is good for two reasons in my opinion. A) when millions of people are accessing these databases, it helps to spread out the load, and doesn't bottleneck the host of the database, and B) this provides a step of security so that if one database is compromised, not every one is, or it makes it more difficult to gather all of the data at the same time.

If someone attempts to look up how to hack facebook, they will only see things such as keyloggers. Why, though? I am sure that this is possible (even if highly impractical), and that someone somewhere would benefit from something like this. I know that these major companies have the money to sue anyone to death who did anything like this, but why hasn't it been done by a hacker yet? (If it has and I didn't realize it, I apologize).

In the end, what makes Facebook not hackable, or at least difficult? In reality it is not bulletproof, because nothing is ever 100% secure. I am sure some people could find this very profitable. Why hasn't this already happened, though? What kind of security measures are these companies taking to prevent things like this?

  • 2
    Wait a second, Facebook has been hacked a number of times. People event went to prison for that. – Hendrik Brummermann Apr 1 '12 at 9:23
9

My answer might be a little less Paranoid Parrot than ThinkerThinker's, although I have to agree on some points. These companies invest a lot in security, they also have a lot of security installed. It would be quite embarrassing if anyone could just walk up to them and hack into their database. So the reason you don't find anything about in on google is either:

  • It's very secure and near to impossible (nothing is impossible, but it's not something you do with a simple howto guide)
  • Even if it happened, why would Facebook even publish it? It's bad publicity.

Spreading a keylogger and just waiting for it to return useful information is easier than trying to hack a facebook database. Plus it generates more passwords for more platforms (paypal,hotmail,gmail,tumblr,...) for one person.

There will always people be trying to get into your system, they use automated scripts. If an open my auth.log I get this from the past 3 minutes (I know I should change the ssh port, but I'm not the one that can decide that):

Apr  1 09:02:14 jugo sshd[15626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.191.36.89 
Apr  1 09:02:20 jugo sshd[15659]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.191.36.89 
Apr  1 09:02:24 jugo sshd[15661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.191.36.89 
Apr  1 09:02:29 jugo sshd[15664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.191.36.89 
Apr  1 09:05:33 jugo sshd[16424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.170.184.53  user=root
Apr  1 09:05:35 jugo sshd[16427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.170.184.53  user=root
Apr  1 09:05:38 jugo sshd[16429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.170.184.53  user=root
Apr  1 09:05:40 jugo sshd[16431]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.170.184.53  user=root
Apr  1 09:05:43 jugo sshd[16433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.170.184.53  user=root

They just try automatically to get into a system with some random passwords and users. In the end there will be a few servers they can get into.

Measures you can take to prevent these attacks:

  • make your code secure
  • white list instead of blacklist
  • least privileged principle
  • Use of firewalls, IDS and IPS.

They also hire penetration testers and security analysts to test their systems and go look for mistakes or problems. It's not impossible, but not it's very hard. There were companies people were able to get into that were published. You only need to have a look at all the companies Lulzsec was able to get into. But remember these guys are highly skilled.

  • I don't consider putting ssh on a different port to be an important security step. However, I will make fun of your company for not disabling password authentication all together :p Then again, I could be misreading your log file. I'm 50% sure that "authetnication failure" means they tried an invalid username/password, and that trying a password login when password logins are disabled gets a different error message. – Conor Mancone Oct 20 '17 at 12:11
  • @ConorMancone this isn't even a company machine...just a toybox. – Lucas Kauffman Oct 24 '17 at 7:13
4

Of course these organisations are hackable and of course it has happened and keeps happening, however there is less need to use technical attacks here as it is so much easier to use social engineering and other people attacks - the very model is built to share personal information so that is what attackers do. It does not hold vast amounts of cash so the profile is different.

3

I know it is an old question, but since OP mentioned Yahoo I will just add, that they had suffered a biggest cyber attack in history.

This is what they said:

Subsequent to Yahoo's acquisition by Verizon, and during integration, the company recently obtained new intelligence and now believes, following an investigation with the assistance of outside forensic experts, that all Yahoo user accounts were affected by the August 2013 theft. While this is not a new security issue, Yahoo is sending email notifications to the additional affected user accounts. The investigation indicates that the user account information that was stolen did not include passwords in clear text, payment card data, or bank account information. The company is continuing to work closely with law enforcement.

*All = 3 billion accounts.

1

Following suit with Mirsad (even though it seems weird to post an answer just to include a link), Facebook just hit the news because of their own issues with properly securing their internal networks:

https://arstechnica.com/information-technology/2017/10/facebook-is-failing-to-meet-the-burden-of-securing-itself-security-chief-says/

The way that I explain to [management] is that we have the threat profile of a Northrop Grumman or a Raytheon or another defense contractor, but we run our corporate network, for example, like a college campus, almost. We have made intentional decisions to give access to data and systems to engineers to make them "move fast," but that creates other issues for us.

Keep in mind that this isn't meant to imply that any ol' person off the street can easily hack into Facebook. They are certainly talking about the next "level" of security. Their primary concern is not random hackers off the street, but rather state-sponsored hacking groups that have large amounts of resources.

In effect, because of their size and because of where they "sit", Facebook is a target not just for run-of-your-mill hacking attempts but also nation-states that would be more than happy to use it (for example) to spy on and disrupt enemies, internal and external. A simple example is that China blocked Facebook in 2009 because "independence activists" were using it as a method of communication. I'm sure China would have been just as happy to hack Facebook and also see the communications of those activists, and who they were. Basically, any country on this list: https://en.wikipedia.org/wiki/Censorship_of_Facebook is a good candidate for someone who would like to hack Facebook.

There aren't that many companies out there that can legitimately be concerned about being a target for nation-state hackers. Facebook is one of them, and it sounds like they are starting to realize that and take it seriously. In the end, the result of that is that they will (hopefully) beef up their security even more, making it harder for anyone to access their internal data in any meaningful way.

Also keep in mind though that it isn't just about the website. There is value in all aspects of their business: payroll, accounting, HR, internal emails, etc... It is easy to think of Facebook as a website to hack, but, as Sony knows there is a whole lot more at stake then just a website.

Hacking large companies should (theoretically) be hard because their prominence means that they are more of a target, and they should take security more seriously. However, it obviously doesn't always work that way in practice, and many large internet companies have suffered from large and successful attacks on their systems and data.

But that doesn't mean its easy.

0

Its probably happening as we type...

Honestly, if someone exploits a backend somewhere, they usually don't go screaming, "I haxor'd teh shitz" like some more ego-brained attempts.

Why do you think Facebook was created? The NSA LOVES IT! 845 million people just giving them EVERYTHING & a timeline of their lives to boot for FREE no wiretaps, no spies...Its like the land of digital milk & honey...

Not to mention some other countries agencies...Chinese*Cough*Russians*Cough

If your into serious info security, you already assume EVERYTHING is compromised by SOMEBODY...Just because, it has to be, in order for "security" to exist... (security theater, Maintaining the illusion of control)

So, YES it is very hackable but, these companies pay out money to hackers to make sure its less vulnerable but, in the end, its a perpetual cycle that keeps people employed. (on both sides of the firewall)

;-)

  • I completely agree. For some it's being paranoid, but it's the truth. Acting consequently may or may not be worthwhile, so many people are very optimistic about the security of their systems. Though, facebook was probably created for other reasons. – Aki Apr 2 '12 at 13:56
  • 1
    You seriously think that Facebook was created to collect information? It might have turned into that but only AFTER the information up until that point which had been collected turned into something Facebook could monitize. – Ramhound Apr 3 '12 at 11:46
  • This is the most paranoid post I read in this year. It's like some kind of chemtrails post – Serverfrog Nov 1 '17 at 10:28

protected by Community Oct 20 '17 at 0:27

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.